GHSA-788m-pj96-7w2c

Source

https://github.com/advisories/GHSA-788m-pj96-7w2c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-788m-pj96-7w2c/GHSA-788m-pj96-7w2c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-788m-pj96-7w2c

Published

2020-09-02T21:23:51Z

Modified

2021-09-27T21:41:40Z

Summary

Cross-Site Scripting in fomantic-ui

Details

Versions of fomantic-ui are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text.

Recommendation

Upgrade to version 2.7.0 or later.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:39:20Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

npm / fomantic-ui

Package

Name: fomantic-ui; View open source insights on deps.dev
Purl: pkg:npm/fomantic-ui

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.7.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-788m-pj96-7w2c/GHSA-788m-pj96-7w2c.json"